Splunk Enterprise

Custom Search Reporting Command

cave_dweller
Observer

Hello,

I am having an issue with piping the output of a custom reporting command, as documented here, into another SPL command. I can get the basic reporting command example to work. It's called "sum" and is provided within the "searchcommands_app" directory of the Splunk Python SDK hosted on GitHub. However, once I get statistics output from the "sum" command, I cannot pipe those results into another command.

This first query works fine:

 

index = _internal | head 200 | sum total=lines linecount

 

However, this query does not work:

 

index = _internal | head 400 | sum total=lines linecount | stats count

 

When I try to pipe the output of the "sum" command into the "stats" command, I get the following error:

 

KeyError at "/opt/splunk/etc/apps/t-digest-custom-command/bin/sum.py", line 63 : 'linecount'

 

Am I getting this error due to a bug in the custom search command API, or am I missing something?

Thanks,

 

Follow up question: why don't reporting commands reduce to a single value for sufficiently large numbers of input events? For example, this query yields a single statistic value as I expect:

 

index = _internal | head 50 | sum total=lines linecount

 

However, this query yields multiple statistic values, even when I only want one value:

 

index = _internal | head 400 | sum total=lines linecount

 

 

 

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...